Executive brief
sgx-dcap-quote-verify-python is a Python library used to verify Intel SGX ECDSA-based quotes, which are cryptographic attestations proving the authenticity of secure enclaves. The library includes a statically linked copy of a vulnerable OpenSSL version (1.1.1s), which could allow attackers with access to forged quote collateral or certificate revocation lists to read sensitive memory contents or cause denial of service during quote verification operations.
Technical details
The vulnerability stems from a transitive dependency on OpenSSL 1.1.1s, which contains CVE-2023-0286 (X.400 address type confusion in X.509 GeneralName). This defect allows an attacker to pass arbitrary pointers to memcmp operations during X.509 certificate and CRL processing. The sgx-dcap-quote-verify-python library invokes the SGX Quote Verification Library, which uses OpenSSL to validate quote collateral (including certificate chains and CRLs) provided during attestation verification. An attacker can exploit this by providing malicious quote collateral containing crafted CRLs or certificates to the sgx_qv_verify_quote function, triggering the vulnerability. Successful exploitation could enable information disclosure by reading sensitive memory contents from the relying party process. The vulnerability was fixed in version 0.0.3.
Affected products
- Mithril Security sgx-dcap-quote-verify-python 0.0.1 through 0.0.2
Timeline
- 2023-02-14: disclosed
- 2023-02-14: patched: Fixed in version 0.0.3